PT-2022-22353 · Jenkins · Jenkins Build Notifications Plugin+1

Long Nguyen · Published 2022-06-30 · Updated 2023-11-22 · CVE-2022-34801

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Jenkins Build Notifications Plugin versions 1.5.0 and earlier

Description The issue is related to the transmission of tokens in plain text as part of the global Jenkins configuration form, potentially resulting in their exposure.

Recommendations For Jenkins Build Notifications Plugin versions 1.5.0 and earlier, update to a version that does not transmit tokens in plain text. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-318

CWE-319

Related Identifiers

CVE-2022-34801

GHSA-7298-W54J-Q7WM

Affected Products

Jenkins

Jenkins Build Notifications Plugin

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-34801 · Security Note
• https://jenkins.io/security/advisory/2022-06-30/#SECURITY-2056 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7298-w54j-q7wm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34801 · Vendor Advisory
• https://github.com/jenkinsci/build-notifications-plugin · Note
• https://t.me/cvenotify/32771 · Telegram Post